Reflected Cross-Site Scripting Vulnerability in TranslatePress Plugin by WordPress

CVE-2026-17505

What is CVE-2026-17505?

CVE-2026-17505 is a reflected cross-site scripting (XSS) vulnerability present in the TranslatePress plugin for WordPress, specifically affecting versions up to and including 3.2.5. TranslatePress is designed to facilitate the creation of multilingual sites by allowing users to translate content directly from the front end of their WordPress site. This vulnerability arises from the plugin's translate_page() function, which inadequately sanitizes and escapes user input, enabling malicious actors to perform script injections through the 's' parameter in search queries.

When exploited, the vulnerability allows attackers to inject arbitrary web scripts into pages that execute within the user's browser, given that they can successfully deceive the user into clicking on a malicious link. This flaw highlights a significant oversight in handling user input, particularly concerning the use of specific marker tokens that bypass typical HTML escaping measures.

Potential Impact of CVE-2026-17505

1. User Data Compromise: The vulnerability enables attackers to execute scripts in the context of a user's browser session, potentially leading to the theft of sensitive data such as session cookies, login credentials, and personal information, thereby posing a severe risk to user privacy and security.

2. Website Integrity and Reputation Damage: By allowing the injection of malicious scripts, this vulnerability can result in website defacement, manipulation of user interactions, or redirection to harmful sites. Such incidents can severely damage the credibility and trustworthiness of the affected organization.

3. Increased Attack Surface for Additional Exploits: Once attackers gain the ability to inject scripts, they can leverage this foothold to deploy further malicious activities, such as spreading malware or establishing additional vulnerabilities within the site, leading to broader security breaches across the web infrastructure.

References